EP1455312A1 - Method and apparatus for maintenance of security sensitive program code of a vehicle - Google Patents

Abstract

Functions on a motor vehicle (MV) (1) are implemented relating to the MV's driving safety. Data is transmitted via a publicly accessible message channel (2) from a maintenance center (31,32) to the MV so as to parameterize, load and/or change a safety-related program code stored in the motor vehicle's data memory. Independent claims are also included for the following: (a) a data-processing unit for a motor vehicle for carrying out a method for parameterizing, loading and/or changing a safety-related program code stored in a motor vehicle's data memory; (b) and for a motor vehicle with a data-processing unit; and (c) a device for parameterizing, loading and/or changing a safety-related program code stored in a motor vehicle's data memory.

Description

The invention relates to a method and a device for parameterizing, loading and / or changing security-relevant program code based on a Data storage is stored on a motor vehicle and by means of its functions are implemented on the motor vehicle, the driving safety of the motor vehicle affect. The invention further relates to a motor vehicle designed in this regard. Motor vehicle in the sense of the invention is in particular an individual in road traffic usable land vehicle. A motor vehicle in the sense of the invention is in particular not limited to land vehicles with internal combustion engines. safety-related Program code in the sense of the invention is program code that the driving safety of Motor vehicle concerns. Examples of security-relevant program code in the sense of Invention are e.g. Programs for anti-lock braking systems, anti-slip systems and Vehicle dynamics control. Such programs are usually only certified in Workshops serviced, e.g. parameterized, loaded and / or changed.

It is an object of the invention to improve the maintenance of such programs.

The aforementioned task is accomplished by a method or a device for Parameterization, loading and / or changing of a data storage on a Motor vehicle stored security-relevant program code solved by whose functions are implemented on the motor vehicle, the driving safety of the Motor vehicle relate, with data for parameterizing, loading and / or changing of the security-relevant program code from a maintenance center to the Motor vehicle, advantageously encrypted, via a publicly accessible Message channel are transmitted or can be transmitted.

The aforementioned task is also carried out by a data processing system Parameterization, loading and / or changing of safety-relevant program code for a motor vehicle or by a motor vehicle with such Data processing system solved, the data processing system one Has data memory in which the security-relevant program code is stored, by means of which functions are implemented on the motor vehicle, which the Driving safety of the motor vehicle concern, and wherein the data storage in which the security-relevant program code is stored, technically with a Interface for a publicly accessible news channel is connected.

In an advantageous embodiment of the invention, before the data is transmitted to the Parameterizing, loading and / or changing the security-relevant program code a certificate from the maintenance center to the motor vehicle, in particular via the or another publicly accessible news channel. moreover takes place in an advantageous embodiment of the invention after the transfer of Certificates and before transferring the data for parameterization, loading and / or Change the security-relevant program code an authorization of Maintenance center.

In a further advantageous embodiment of the invention, the Certificates, especially in a different one from the maintenance center Encryption center, an identification document that generates at least one contains first public data encryption key k. The identification document can also provide access authorization information e.g. in different Security levels and information to identify the maintenance center contain.

In a further advantageous embodiment of the invention for generating the Certificates, especially in the one different from the maintenance center Encryption center, a hash value formed from the identification document. Examples of hash values can e.g. the essay by M. Naor and M. Yung 'Universal One-Way Hash Functions and Their Cryptographic Applications', Proceedings of the Twenty First Annual ACM Symposium on Theory of Computing, USA become.

In a further advantageous embodiment of the invention, the hash value especially in the one different from the maintenance center Encryption center, through encryption with a second private Data encryption key ε * (private key) is an encrypted hash value.

In a further advantageous embodiment of the invention, the certificate, in particular in the encryption center other than the maintenance center from which Identification document and the encrypted hash value.

In a further advantageous embodiment of the invention, the certificate is issued by one of the encryption center to the maintenance center, in particular through the or another publicly accessible News channel, transmitted.

In a further advantageous embodiment of the invention, the encrypted hash value, in particular by means of a second public to second private data encryption key ε * associated data decryption key ε (public key), from which Motor vehicle decrypted.

In a further advantageous embodiment of the invention, the motor vehicle own hash value is formed and compared with the encrypted hash value.

In a further advantageous embodiment of the invention, the certificate is not manipulated viewed if the encrypted hash value with your own hash value matches.

In a further advantageous embodiment of the invention, one of the motor vehicles Test sequence with the first public data encryption key k encrypted.

In a further advantageous embodiment of the invention, the test sequence is a sequence of Random characters generated by the motor vehicle.

In a further advantageous embodiment of the invention, the first public data encryption key k encrypted test sequence, in particular via the or another publicly accessible news channel, transferred to the maintenance center.

In a further advantageous embodiment of the invention, the first public data encryption key k encrypted test sequence in Maintenance center using a first private to first public data encryption key k associated data decryption key k * decrypted.

In a further advantageous embodiment of the invention, in the maintenance center one known to both the maintenance center and the motor vehicle Response algorithm generates a test sequence response and this using the first private data decryption key k * encrypted.

In a further advantageous embodiment of the invention, the first private Data decryption key k * encrypted test sequence response, in particular via the or another publicly accessible news channel to which Transfer motor vehicle.

In a further advantageous embodiment of the invention, the first private Data decryption key k * encrypted test sequence response from Motor vehicle decrypted with the public data encryption key k and checked for correctness.

In a further advantageous embodiment of the invention, the motor vehicle sees this Service center as authorized if the test sequence response is correct is seen.

In a further advantageous embodiment of the invention, the motor vehicle temporary, in particular only valid for a transmission, third (secret) Data encryption key s (secret key), advantageously depending on one Random number sequence, formed.

In a further advantageous embodiment of the invention, the third Data encryption key s, in particular by means of the first public data encryption key k, encrypted.

In a further advantageous embodiment of the invention, the one with the first public data encryption key k encrypted third Data encryption key s, in particular via the or another publicly accessible news channel, transmitted to the maintenance center.

In a further advantageous embodiment of the invention, the one with the first public data encryption key k encrypted third data encryption key s (in the maintenance center) by means of the first private to the first public data encryption key k associated data decryption key k * decrypted.

In a further advantageous embodiment of the invention, the data for Parameterizing, loading and / or changing the security-relevant program code encrypted with the third data encryption key s and, in particular via the or another publicly accessible news channel, to the motor vehicle transfer.

In a further advantageous embodiment of the invention, those with the third data encryption key s encrypted data for parameterization, loading and / or Changing the security-relevant program code of the motor vehicle using the third data encryption key s decrypted.

The aforementioned advantageous configurations are particularly relevant in relation to unauthorized data manipulation secure configurations with reciprocal Communication. The following advantageous configurations are particularly for Parameterizing, loading and / or changing the security-relevant program code suitable for a large number of motor vehicles.

In a further advantageous embodiment of the invention, the Data for parameterizing, loading and / or changing the safety-relevant Program codes a string that is advantageously a random string from the maintenance center to the motor vehicle, in particular via the or another publicly accessible news channel.

In a further advantageous embodiment of the invention, the string before Transmission from the maintenance center to the motor vehicle by means of a first Data encryption key p encrypted.

In a further advantageous embodiment of the invention, the first Data encryption key p encrypted string from the Maintenance center transferred to the motor vehicle.

In a further advantageous embodiment of the invention, the first Data encryption key p encrypted string from the Maintenance center transferred to the motor vehicle. This will continue to be more advantageous Embodiment of the invention from the motor vehicle by means of one to the first Data encryption key p belonging to the first data decryption key p *, which is advantageously known to a plurality of motor vehicles, is decrypted.

In a further advantageous embodiment of the invention, in the maintenance center the string, a second, in particular temporary, data encryption key b formed. In addition, in a further advantageous embodiment of the invention from Motor vehicle from the string of the second, especially temporary, to Data encryption key b formed. It is also possible that from Maintenance center / motor vehicle a key pair is formed instead of a key.

In a further advantageous embodiment of the invention, the data for Parameterizing, loading and / or changing the security-relevant program code encrypted with the second (secret) data encryption key b and, in particular via the or another publicly accessible news channel, transmitted to the motor vehicle or to a plurality of motor vehicles. With the second (secret) data encryption key b encrypted data Parameterizing, loading and / or changing the security-relevant program code are from the motor vehicle in a further advantageous embodiment of the invention of the second data encryption key b decrypted.

In an advantageous embodiment of the invention, data for parameterizing, loading and / or changing the security-relevant program code by means of a temporary data decryption key transmitted encrypted. This will advantageously especially for the transmission of data for parameterization, loading and / or changing the security-relevant program code, ie for one Maintenance measure generated. In a further advantageous embodiment of the invention the temporary data decryption key for this depends on a random string generated.

As already stated, the aforementioned task is performed by a Data processing system for a motor vehicle for parameterizing, loading and / or Change of security-relevant program code or by using a motor vehicle solved such a data processing system, the data processing system has a data memory in which the security-relevant program code is stored, by means of which functions are implemented on the motor vehicle, the concern the driving safety of the motor vehicle, and wherein the data storage in which the security-relevant program code is stored, technically with a Interface for a publicly accessible news channel is connected. Advantageous configurations result in particular from one of these Design of the data processing system, so that the aforementioned ones Process steps that relocate the motor vehicle can be carried out.

The data processing system in an advantageous embodiment of the invention a computer arrangement for decrypting encrypted data Parameterizing, loading and / or changing the security-relevant program code on. The computer arrangement is a further advantageous embodiment of the invention to generate a test string and in particular also to encrypt the Test string trained. In a further advantageous embodiment of the invention does the data processing system or the computer arrangement contain a function, by means of which a data decryption key from a received character string b for encrypting and decrypting encrypted transmitted data for parameterization, Loading and / or changing the security-relevant program code can be calculated.

The aforementioned methods and devices are also for parameterization, loading and / or changing the less or not security-relevant program code usable, but are for parameterizing, loading and / or changing the less or non-security-relevant program codes are particularly advantageous and of particular economic importance.

Fig. 1

eine Ausgestaltung einer Einrichtung zum Parametrieren, Laden und/oder Verändern von sicherheitsrelevantem Programmcode,

Fig. 2

eine Ausgestaltung einer Datenverarbeitungsanlage für ein Kraftfahrzeug,

Fig. 3

eine weitere Ausgestaltung einer Einrichtung zum Parametrieren, Laden und/oder Verändern von sicherheitsrelevantem Programmcode,

Fig. 4

ein Verfahren zum Erzeugen eines Zertifikates,

Fig. 5

ein Verfahren zur Übertragung von Daten zum Parametrieren, Laden und/oder Verändern von sicherheitsrelevantem Programmcode,

Fig. 6

eine Legalisierungsphase,

Fig. 7

eine Autorisierungsphase,

Fig. 8

eine Datenübertragungsphase und

Fig. 9

ein Verfahren zur Übertragung von Daten zum Parametrieren, Laden und/oder Verändern von sicherheitsrelevantem Programmcode.

Further advantages and details emerge from the following description of exemplary embodiments. Show:

Fig. 1

an embodiment of a device for parameterizing, loading and / or changing security-relevant program code,

Fig. 2

an embodiment of a data processing system for a motor vehicle,

Fig. 3

a further embodiment of a device for parameterizing, loading and / or changing security-relevant program code,

Fig. 4

a method for generating a certificate,

Fig. 5

a method for transmitting data for parameterizing, loading and / or changing safety-relevant program code,

Fig. 6

a legalization phase,

Fig. 7

an authorization phase,

Fig. 8

a data transfer phase and

Fig. 9

a method for the transmission of data for parameterizing, loading and / or changing security-relevant program code.

1 shows an embodiment of a device for parameterizing, loading and / or Changing security-relevant program code, by means of its functions a motor vehicle 1 are implemented which improve the driving safety of the motor vehicle 1 affect. Examples of security-relevant program code in the sense of the invention are e.g. Programs for anti-lock braking systems, anti-slip systems and Vehicle dynamics control. For parameterizing, loading and / or changing the safety-relevant program codes are data for parameterization, loading and / or changing the security-relevant program code via a public accessible message channel 2, in particular an internet-like connection such as Email, transmitted from a maintenance center 3 to the motor vehicle 1. The Double arrows 4 and 5 indicate that messages from the Maintenance center 3 to the motor vehicle 1 as well as messages from the Motor vehicle 1 can be transmitted to the maintenance center 3. This is on A data processing system 6 is arranged in motor vehicle 1.

2 shows a possible embodiment of such a device on the motor vehicle 1 arranged data processing system 6. This has a computer arrangement 11 a data memory 27, by means of whose security-relevant program code for Implementation of functions relating to driving safety of motor vehicle 1 are saved. The computer arrangement 11 is, for example, via a CAN bus 21 with components 25.1, 25.2, 25.3 relating to the driving safety of motor vehicle 1, 25.4 and 25.5, such as an anti-slip control. The data storage 27 can also be used separately or in whole or in part on components 25.1, 25.2, 25.3, 25.4 and 25.5 distributed. The data memory 27 is by means of Computer arrangement 11 via a connection module 13 with or multiple interfaces to one or more publicly accessible News channels connected. In an exemplary embodiment it is provided that the connection module 13 with a Bluetooth interface 14, one WLAN interface 15, a GSM / GRPS interface 16 and a radio interface 17 connected is.

In an exemplary embodiment, an infotainment module 10 is provided, which via the Connection module 13 with at least one of the interfaces such as the Bluetooth Interface 14, the WLAN interface 15, the GSM / GRPS interface 16 and the Radio interface 17 is connected so that information or entertainment data for People in the motor vehicle can be loaded and / or sent. For example, Internet access or the sending and receiving of e-mails using some of in Terminals 24.1, 24.2, 24.3, 24.4, 24.5 and 24.6 arranged in the motor vehicle possible. The infotainment module 10 and the terminals 24.1, 24.2, 24.3, 24.4, 24.5 and 24.6 are connected to one another by means of a MOST network 20. The Infotainment module 10 and computer arrangement 11 are both software-related as well as separated in terms of hardware.

A non-security-relevant module 12 is also in an exemplary embodiment provided that via the connection module 13 with at least one of the interfaces like the Bluetooth interface 14, the WLAN interface 15, they GSM / GRPS Interface 16 and the radio interface 17 for parameterization, loading and / or Change the non-security-relevant program code, which e.g. Light, Heating or climate control of the motor vehicle 1 relates.

3 shows a further embodiment of a device for parameterizing, loading and / or changing the security-relevant program code of a motor vehicle 1 via a publicly accessible news channel 2, such as the Internet. The Device for parameterizing, loading and / or changing safety-relevant Program code has at least two maintenance centers 31 and 32. The Maintenance centers 31 and 32 each have computing devices 31.1, 31.2, 31.3, 31.4 and 31.5 and 32.1, 32.2, 32.3, 32.4 and 32.5, each via a network 31.10 as well 32.10 are each connected to a maintenance server 33 or 34. It is provided that the security-relevant program code or data for parameterization, loading and / or changing the security-relevant program code Computing devices 31.1, 31.2, 31.3, 31.4 and 31.5 as well as 32.1, 32.2, 32.3, 32.4 and 32.5. However, it is advantageously provided that only the Maintenance servers 33 and 34 are authorized to communicate with the motor vehicle 1. It is also advantageously provided that the maintenance servers 33 and 34 are particularly secured against theft. The double arrows 44, 45 and 46 indicate that both between the maintenance server 33 and thus the maintenance center 31 and the motor vehicle 1 and between the maintenance server 34, and thus the Maintenance center 32 and the motor vehicle 1 via the public message channel 2 bidirectional communication is possible or can be set up.

An encryption center 30 is also provided, the function of which is based on Fig. 4 is explained in connection with the dashed arrows 40, 41 and 42.

4 shows a method for generating a certificate, by means of which a Maintenance center 3, 31, 32 or a maintenance server 33, 34 opposite one Motor vehicle legalized. For this purpose, a step 50 is used to create the certificate Identification document X generates that at least a first public Contains data encryption key k. The identification document X can also Access authorization information e.g. in different security levels as well Information for identifying the or at least one of the maintenance centers 3, 31, 32 included.

In a next step 51, the identification document X becomes a hash value h, e.g. according to the essay by M. Naor and M. Yung 'Universal One-Way Hash Functions and Their Cryptographic Applications', Proceedings of the Twenty First Annual ACM Symposium on Theory of Computing, USA. the Step 51 is followed by a step 52 in which the hash value h is encrypted with a second private data encryption key ε * an encrypted Hash value h 'is formed. In a further step 53, the certificate from the Identification document X and the encrypted hash value h 'composed.

In a further advantageous embodiment of the invention it is provided that the Steps 50, 51, 52 and 53 to form the certificate not in one Maintenance center 31 or 32, but run in the encryption center 30. In In this case, step 53 is followed by step 54, in which the certificate from Encryption center 30 to one or more of the maintenance centers 31, 32 is transmitted. This transmission can be made via the publicly accessible Message channel 2 take place, which is indicated by the dashed arrow 40. The aforementioned transmission can also take place in another way, which is caused by the dashed arrows 41 and 42 is indicated.

5 shows a method for transferring data for parameterization, loading and / or changing security-relevant program code. The transfer of Data for parameterizing, loading and / or changing safety-relevant Program code is divided into a legalization phase 56, a Authorization phase 57 and a data transmission phase 58.

6 shows an exemplary embodiment for method steps of a legalization phase 56. The certificate is issued in a step 60 from the maintenance center 3, 31 or 32 the motor vehicle 1 transmitted via the publicly accessible news channel 2. The encrypted hash value h 'contained in the certificate is then in a step 61 by means of a second public to second private data encryption key ε * associated data decryption key ε on the motor vehicle 1 from the Data processing system 6 decrypted. Step 61 is followed by step 62 in which a separate hash value h∼ is formed by the motor vehicle 1. This is in one Step 63 compared to the hash value h. The certificate is considered not to be manipulated viewed if the hash value h matches the own hash value h∼. In In this case, the corresponding maintenance center 3, 31 or 32 is legalized.

7 shows an exemplary embodiment for method steps of an authorization phase 57. After successful legalization, the motor vehicle 1 in a step 70 a test sequence, which is a sequence of random characters, is generated and in another Step 71 encrypted with the first public data encryption key k. That encrypted with the first public data encryption key k The test sequence is in a further step 72 via the publicly available Transmit message channel 2 to the corresponding maintenance center 3, 31 or 32.

In the corresponding maintenance center 3, 31 or 32, the one with the first public data encryption key k encrypted test sequence in one Step 74 using a first private to first public Data encryption key k associated data decryption key k * decrypted. Thereafter, in a step 75 following the step 74, in the corresponding maintenance center 3, 31 or 32 by means of both corresponding maintenance center 3, 31 or 32 as well as the motor vehicle 1 known response algorithm generates a test sequence response and this using the first private data decryption key k * encrypted. In another Step 76 is the one with the first private data decryption key k * encrypted test sequence response via the publicly available Message channel 2 transmitted to the motor vehicle 1.

The data processing system 6 on the motor vehicle is used in a step 77 test sequence response encrypted with the first private data decryption key k * from the motor vehicle with the public data encryption key k decrypted. In a step 78 following step 77, a test sequence response by means of both the corresponding maintenance center 3, 31 or 32 as also the motor vehicle 1 known response algorithm formed and with the public data encryption key k decrypted encrypted Test sequence response compared. Do the two test sequence answers match is sent from the corresponding maintenance center 3, 31 or 32 encrypted test sequence response considered correct. In this case it sees Motor vehicle 1 the corresponding maintenance center 3, 31 or 32 as authorized.

8 shows an exemplary embodiment for method steps of a data transmission phase 58, which in particular only takes place after successful authorization. Thereby in a step 80 from that arranged on the motor vehicle 1 Data processing system 6 a temporary, according to this embodiment only for the following data transmission of valid, third (secret) data encryption keys s formed. In a subsequent step 81, the third (secret) Data encryption key s by means of the first public data encryption key k encrypted and in a further step 82 via the public accessible message channel 2 to the corresponding maintenance center 3, 31 or 32 transferred.

Step 82 is followed by step 83, in which the one with the first public data encryption key k encrypted third (secret) data encryption keys s in the corresponding maintenance center 3, 31 or 32 using the first private data decryption key belonging to the first public data encryption key k k * is decrypted. Then the data for Parameterizing, loading and / or changing the security-relevant program code with the third (secret) data encryption key s in a step 84 encrypted and in a step 85 via the publicly accessible Message channel 2 to the motor vehicle 1 or the data processing system 6 transfer.

Step 85 is followed by step 86, in which the data encryption key with the third (secret) key s encrypted data for parameterization, loading and / or Changing the security-relevant program code from that on the motor vehicle 1 arranged data processing system 6 by means of the third (secret) Data encryption key s are decrypted. In a final Step 87 is followed by the actual parameterization, loading and / or changing of the security-relevant program codes.

The method according to FIGS. 5, 6, 7 and 8 is particularly in the 4 in connection with a certificate formed according to FIG on unauthorized data manipulation safe embodiment. However, it continues a dialogue between a maintenance center and a motor vehicle. 9, an alternative embodiment is described, the particular for parameterizing, loading and / or changing the safety-relevant Program codes of a variety of motor vehicles is suitable.

In step 90, a character string consisting of random characters is created predetermined length of a maintenance center 3, 30, hereinafter referred to as a software broadcast server is generated. The string is in one subsequent step 91 using a first data encryption key p encrypted and in a step 92 from the software broadcast server 3 to the Motor vehicle 1 transmitted.

In a further step 93, the data encryption key p encrypted string from that arranged on the motor vehicle 1 Data processing system 6 by means of a first data encryption key p associated first data decryption key p *, which is a plurality of Motor vehicles is known, decrypted. Step 93 is followed by step 94 in which from the data processing system 6 arranged on the motor vehicle 1 from the String, in particular a temporary, second data encryption key b is formed.

In a step 95, the software broadcast server 3, 30 also uses the String of the second data encryption key b is formed. It follows Step 96, in which the data for parameterizing, loading and / or changing the security-relevant program codes with the second data encryption key b encrypted and via the publicly accessible news channel 2 to the Motor vehicle 1 or transmitted to a plurality of motor vehicles.

A step 97 follows in which the encrypted data for parameterizing, loading and / or changing the security-relevant program code from that on the Motor vehicle 1 arranged data processing system 6 by means of the second Data encryption key b are decrypted. After that, the second Data encryption key b deleted. The actual parameterization follows, Loading and / or changing the security-relevant program code.

The methods according to the exemplary embodiments can be used as an integrated system be implemented that enables both approaches. So he can with Block encryption center and software broadcast server denoted by reference numerals his.

LIST OF REFERENCE NUMBERS

1

motor vehicle

2

publicly accessible news channel

3

Maintenance center, software broadcast server

4, 5, 40, 41, 42, 43, 44, 45, 46

Arrows to indicate data flows

6

Data processing system

10

infotainment module

11

computer arrangement

12

non-security relevant module

13

connecting module

14

Bluetooth interface

15

WLAN interface

16

GSM / GRPS interface

17

Radio interface

20

MOST network

21

CAN bus

24.1, 24.2, 24.3, 24.4, 24.5, 24.6

terminals

25.1, 25.2, 25.3, 25.4, 25.5

Components related to driving safety of the motor vehicle

27

data storage

30

Encryption center, maintenance center, software broadcast server

31.32

maintenance center

31.1, 31.2, 31.3, 31.4, 31.5, 32.1, 32.2, 32.3, 32.4, 32.5

computing devices

33, 34

maintenance server

50, 51, 52, 53, 54, 56, 57, 58, 60, 61, 62, 63, 70, 71, 72, 73, 74, 75, 76, 77, 78, 80, 81, 82, 83, 84, 85, 86, 87, 88, 90, 91, 92, 93, 94, 95, 96, 97

steps

b, b *, ε, ε * k, k *, p, p *, s, s *

key data

X

identification document

h, h ', h *, h∼

hash

Claims (46)

Method for parameterizing, loading and / or changing a, in particular safety-relevant, program code, which is stored on a data memory (27) on a motor vehicle (1) and by means of whose functions are implemented on the motor vehicle (1), which improve the driving safety of the motor vehicle ( 1), characterized in that data for parameterizing, loading and / or changing the security-relevant program code is transmitted from a maintenance center to the motor vehicle (1) via a publicly accessible message channel (2). Method according to Claim 1, characterized in that a certificate is transmitted from the maintenance center to the motor vehicle (1) before the data for parameterizing, loading and / or changing the security-relevant program code are transmitted via the publicly accessible message channel (2). Method according to Claim 2, characterized in that an identification document (X) which contains at least a first public data encryption key (k) is generated to generate the certificate. Method according to Claim 3, characterized in that a hash value (h) is formed from the identification document (X) in order to generate the certificate. Method according to claim 4, characterized in that an encrypted hash value (h *) is formed from the hash value (h) by encryption with a second private data encryption key (ε *). A method according to claim 5, characterized in that the certificate is composed of the identification document and the encrypted hash value (h *). Method according to one of claims 2 to 6, characterized in that the certificate is generated in an encryption center (30) different from the maintenance center (3, 31, 32). Method according to claim 7, characterized in that the certificate is transmitted from an encryption center (30) different from the maintenance center (3, 31, 32) to the maintenance center (3, 31, 32). Method according to claim 8, characterized in that the encrypted hash value (h *) is decrypted by the motor vehicle (1) by means of a second public data decryption key (ε) belonging to the second private data encryption key (ε *). Method according to Claim 9, characterized in that the motor vehicle (1) forms its own encrypted hash value (h ~ *) and compares it with the encrypted hash value (h *). Method according to claim 10, characterized in that the certificate is regarded as not manipulated if the encrypted hash value (h *) matches its own encrypted hash value (h ~ *). Method according to one of claims 3 to 11, characterized in that a test sequence is encrypted with the first public data encryption key (k) by the motor vehicle (1). Method according to claim 12, characterized in that the test sequence is a sequence of random characters which is generated by the motor vehicle (1). Method according to Claim 12 or 13, characterized in that the test sequence encrypted with the first public data encryption key (k) is transmitted to the maintenance center (3, 31, 32) via the publicly accessible message channel (2). Method according to claim 14, characterized in that the test sequence encrypted with the first public data encryption key (k) is decrypted in the maintenance center (3, 31, 32) by means of a first private data decryption key (k *) belonging to the first public data encryption key (k). Method according to Claim 15, characterized in that a test sequence response is generated in the maintenance center (3, 31, 32) by means of a response algorithm known both to the maintenance center (3, 31, 32) and to the motor vehicle (1) and this is done by means of the first private one Data decryption key (k *) is encrypted. Method according to claim 16, characterized in that the test sequence response encrypted with the first private data decryption key (k *) is transmitted to the motor vehicle (1) via the publicly accessible message channel (2). Method according to claim 17, characterized in that the test sequence response encrypted with the first private data decryption key (k *) is decrypted by the motor vehicle (1) with the public data encryption key (k) and checked for correctness Method according to claim 18, characterized in that the motor vehicle (1) regards the maintenance center (3, 31, 32) as authorized if the test sequence response is considered correct. Method according to one of the preceding claims, characterized in that the motor vehicle (1) forms a temporary third data encryption key s. Method according to claim 20, characterized in that the third data encryption key s is encrypted by means of the first public data encryption key (k). Method according to claim 21, characterized in that the third data encryption key s encrypted with the first public data encryption key (k) is transmitted to the maintenance center (3, 31, 32) via the publicly accessible message channel (2). Method according to claim 22, characterized in that the third data encryption key s encrypted with the first public data encryption key (k) is decrypted by means of the first private data decryption key (k *) belonging to the first public data encryption key (k). Method according to claim 23, characterized in that the data for parameterizing, loading and / or changing the security-relevant program code is encrypted with the third data encryption key s and transmitted to the motor vehicle (1) via the publicly accessible message channel (2). Method according to one of claims 20 to 24, characterized in that the data encrypted with the third data encryption key s for parameterizing, loading and / or changing the security-relevant program code is decrypted by the motor vehicle (1) by means of the third data encryption key s. A method according to claim 1, characterized in that before the transmission of the data for parameterizing, loading and / or changing the security-relevant program code, a character string is transmitted from the maintenance center (3, 31, 32) to the motor vehicle via the publicly accessible message channel (2) becomes. A method according to claim 26, characterized in that the string is a random string. A method according to claim 26 or 27, characterized in that the character string is encrypted before transmission from the maintenance center (3, 31, 32) to the motor vehicle (1) by means of a first data encryption key (p). Method according to claim 28, characterized in that the character string encrypted with the first data encryption key (p) is transmitted from the maintenance center (3, 31, 32) to the motor vehicle (1). A method according to claim 29, characterized in that the character string encrypted with the first data encryption key (p) is decrypted by the motor vehicle (1) by means of a first data decryption key (p *) belonging to the first data encryption key (p). A method according to claim 30, characterized in that the first data decryption key (p *) is known to a plurality of motor vehicles. Method according to one of Claims 26 to 31, characterized in that a second data encryption key (b) is formed from the character string in the maintenance center. Method according to claim 32, characterized in that the motor vehicle (1) forms the second data encryption key (b) from the character string. Method according to claim 32 or 33, characterized in that the data for parameterizing, loading and / or changing the security-relevant program code is encrypted with the second data encryption key (b) and transmitted to the motor vehicle (1) via the publicly accessible message channel (2). Method according to claim 32 or 33, characterized in that the data for parameterizing, loading and / or changing the security-relevant program code is encrypted with the second data encryption key (b) and transmitted to a plurality of motor vehicles via the publicly accessible message channel (2). Method according to claim 34 or 35, characterized in that the data encrypted with the second data encryption key (b) for parameterizing, loading and / or changing the security-relevant program code of the motor vehicle (1) is decrypted using the second data encryption key (b). Method according to one of the preceding claims, characterized in that data for parameterizing, loading and / or changing the security-relevant program code are transmitted in encrypted form by means of a temporary data decryption key. A method according to claim 37, characterized in that the temporary data decryption key is generated specifically for the transmission of the data for parameterizing, loading and / or changing the security-relevant program code. A method according to claim 37 or 38, characterized in that the temporary data decryption key is generated as a function of a random string. Data processing system (6) for a motor vehicle (1) for carrying out a method for parameterizing, loading and / or changing security-relevant program code according to one of the preceding claims, wherein the data processing system (6) has a data memory (27) in which the security-relevant program code is stored , by means of which functions are implemented on the motor vehicle (1) that relate to the driving safety of the motor vehicle (1), characterized in that the data memory (27) in which the safety-relevant program code is stored is data-technically with an interface for a publicly accessible one Message channel (2) is connected. Data processing system (6) for a motor vehicle (1) according to claim 40, characterized in that it has a computer arrangement (11) for decrypting encrypted transmitted data for parameterizing, loading and / or changing the security-relevant program code. Data processing system (6) for a motor vehicle (1) according to claim 41, characterized in that the computer arrangement (11) is designed to generate a test string. A data processing system (6) for a motor vehicle (1) according to claim 42, characterized in that the computer arrangement (11) is designed to encrypt the test string. Data processing system (6) for a motor vehicle (1) according to claim 41, 42 or 43, characterized in that it contains a function by means of which a data encryption key (b) for decrypting encrypted transmitted data for parameterizing, loading and / or on a received character string Changing the security-relevant program code can be calculated. Motor vehicle, characterized in that it has a data processing system (6) according to claim 40, 41, 42, 43 or 44. Device for parameterizing, loading and / or changing security-relevant program code stored on a data memory (27) on a motor vehicle (1) according to a method according to one of claims 1 to 39, functions of the motor vehicle (1) being implemented by means of the security-relevant program code , which relate to the driving safety of the motor vehicle (1), characterized in that by means of the data for parameterizing, loading and / or changing the safety-relevant program code from a maintenance center (3, 31, 32) to the motor vehicle (1) via a publicly accessible message channel (2) can be transferred.

Images